CmdID

CmdID / Files

rdpshell.exe

RemoteApp Shell file version info

Program on Windows 15 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real rdpshell.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionRemoteApp Shell

15 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\rdpshell.exe · signed by Microsoft Windows

de993892ea934b3521c85706e8f8b2fb6852f8a9ab08c234bc015038272dcbaa

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\rdpshell.exe · signed by Microsoft Windows

176e42ef2008fdcec0c65e85a0c5fa72b13114507c7dddea66cc58f4569dd756

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\rdpshell.exe · signed by Microsoft Windows

407a7dca4722725826f0d2bbea6d5c774b9d21930d96e66bfdb100d49174816e

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\rdpshell.exe · signed by Microsoft Windows

b993c11d6b0d0cecea703ebc4a26bb0c637992b881156cd9184cc899bd74c383

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\rdpshell.exe · signed by Microsoft Windows

da6c395a2018d3439ad580a19e6a1ca5ff29ef9074411ee9f9f1b0a6365dfebd

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\rdpshell.exe · signed by Microsoft Windows

f198566032c3ba7f8fbcf88a55a0153855f8aa5d2efaeb1d0b8c077fd973a995

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\rdpshell.exe · signed by Microsoft Windows

6af4c8d9467f68d6427c3349c0768276619262eb9aeda56af64ea942206676bb

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\rdpshell.exe · signed by Microsoft Windows

0ba3ec75c65c2eb4ff89d6caf49c0e46e6611dfde6d0b92d9de18c09d4c77678

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\rdpshell.exe · signed by Microsoft Windows

7074f785dd16cccd4406f19443a77b453c395d1f532895e5bc768bc42e78ddb0

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\rdpshell.exe · signed by Microsoft Windows

8adee00d342001be30c5cb3ea678b89b87663f14815c67e4bd0c19ff8e67b0a4

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\rdpshell.exe · signed by Microsoft Windows

b1bfb826a9e765aaafea339f585c4e66e7dd61673094abaaaac23e093c1374ed

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\rdpshell.exe · signed by Microsoft Windows

016ebc911c7611d59d2897585949c0dbd0bb18df41d1df473f9359707c9816df

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\rdpshell.exe · signed by Microsoft Windows

bbffd5c2a0f692e633113e27d052ade5861da8f266bcc91001f4276d57409811

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\rdpshell.exe · not signed

85daccce2a734a33d54849a046e8b1f1709c9fdd6e43c828c09e1f2d48eda22b

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\rdpshell.exe · not signed

8791c2d6e37eb517ea4fcc9a719fdaabf77d7ff6d83a8716212559ee7d589d3f

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.